From a0aa52a646655754854b4f3c07dd737d2f9c2488 Mon Sep 17 00:00:00 2001
From: Guido van Rooij <guido@FreeBSD.org>
Date: Tue, 27 Jun 1995 17:26:27 +0000
Subject: [PATCH] reject option in ip_fw used to panic the system. This fixes
 it.

-Guido
Reviewed by:
Submitted by:
Obtained from:
---
 sys/netinet/ip_fw.c    | 20 +++++++-------------
 sys/netinet/ip_input.c |  4 ++--
 2 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/sys/netinet/ip_fw.c b/sys/netinet/ip_fw.c
index 8e0bc5b73a93..62a0c72899d7 100644
--- a/sys/netinet/ip_fw.c
+++ b/sys/netinet/ip_fw.c
@@ -309,24 +309,15 @@ bad_packet:
 			 * packets....:)
 			 */
 		if (f_prt==IP_FW_F_ICMP)
-			return 0;
+			goto return_0;
 			/*
 			 * Reply to packets rejected
 			 * by entry with this flag
 			 * set only.
 			 */
 		if (!(f->fw_flg&IP_FW_F_ICMPRPL))
-			return 0;
-   		m = m_get(M_DONTWAIT, MT_SOOPTS);
-			/*
-			 * We never retry,we don't want to
-			 * waste time-it is not so critical
-			 * if ICMP unsent.
-			 */
-		if (!m)
-			return 0;
-   		m->m_len = sizeof(struct ip)+64;
-   		bcopy((caddr_t)ip,mtod(m, caddr_t),(unsigned)m->m_len);
+			goto return_0;
+		m = dtom(ip);
 		if (f_prt==IP_FW_F_ALL)
    			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0L, 0);
 		else
@@ -337,8 +328,11 @@ bad_packet:
 		 * If global icmp flag set we will do
 		 * something here...later..
 		 */
-		return 0;
+		return_0;
 	}
+return_0:
+	m_freem(m);
+	return 0;
 good_packet:
 	return 1;
 }
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index a463193cd241..c1a3b5a98eec 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
- * $Id: ip_input.c,v 1.21 1995/05/11 00:13:18 wollman Exp $
+ * $Id: ip_input.c,v 1.23 1995/06/13 17:51:10 wollman Exp $
  */
 
 #include <sys/param.h>
@@ -243,7 +243,7 @@ next:
 
         if (ip_fw_chk_ptr!=NULL)
                if (!(*ip_fw_chk_ptr)(ip,m->m_pkthdr.rcvif,ip_fw_chain) ) {
-                       goto bad;
+                       goto next;
                }
 
 	/*